CVE-2026-71321
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, the internal island renderer endpoint `/__nuxt_island/...` decodes and hashes attacker-controlled JSON body input with destr and ohash before validating the URL-resident hash. An unauthenticated `POST /__nuxt_island/_.json` with a large JSON body is fully read, parsed, hashed, and then rejected, which wastes CPU on Nitro single event loop and delays concurrent requests. No valid hash and no authentication are required. This issue is fixed in 3.21.10 and 4.5.1.
Risk Assessment
An attacker can cause CPU exhaustion and request delays, leading to reduced service availability.
Recommendation
Update Nuxt to version 3.21.10 or 4.5.1, which include a fix for this issue.
Other vulnerabilities in Nuxt
See all- CVE-2026-71319Critical
Nuxt before 3.3.1 in development mode exposes an unauthenticated RPC channel over the Vite HMR WebSocket. An attacker who can reach the HMR port can call methods like updateOptions() and openInEditor(), allowing arbitrary program execution on the developer's machine.
- CVE-2026-72744Medium
Information disclosure vulnerability in Nuxt versions >= 4.4.7 and < 4.5.1, and >= 3.21.7 and < 3.21.10. The Chrome DevTools workspace endpoint in the development server trusts the Host header instead of the peer address, allowing an unauthenticated LAN attacker to retrieve the project's root directory path and a workspace UUID.
- CVE-2026-71320High
Nuxt is an open-source web development framework for Vue.js. From 3.4.0 until 3.21.10 and 4.5.1, an attacker can inject a template key through /__nuxt_island/ props into a dynamic component when `vue.runtimeCompiler: true` is enabled, causing template execution in the Nitro process. This issue is fixed in 3.21.10 and 4.5.1.
- CVE-2026-71318Medium
Nuxt, an open-source web development framework for Vue.js, from version 3.1.0 until 3.21.10 and 4.5.1, allows an attacker to supply a top-level 'as' prop to the /__nuxt_island/ endpoint and drive dynamic component resolution through <component :is>, resolveDynamicComponent, or h(). This issue is fixed in 3.21.10 and 4.5.1.
- CVE-2026-71316High
Nuxt is an open-source web development framework for Vue.js. From 4.4.0 until 4.5.1, runtime cache:nuxt:payload entries for /<page>/_payload.json can be returned before route middleware and page guards because import.meta.prerender is not enforced, disclosing another user's SSR data. This issue is fixed in 4.5.1.
- CVE-2026-71315High
Nuxt is an open-source web development framework for Vue.js. From 3.21.7 until 3.21.10 and 4.5.1, mixed-case routeRules keys can fail to match case-folded lookups when router.options.sensitive is false and drop appMiddleware authorization gates. This is caused by an incomplete fix for CVE-2026-53721. This issue is fixed in 3.21.10 and 4.5.1.
- CVE-2026-71314High
Nuxt, an open-source web development framework for Vue.js, contains a vulnerability allowing an unauthenticated attacker to trigger unbounded SSR memory allocation via the v-for prop in server islands, potentially crashing the Nuxt process. Affects versions from 3.1.0 to 3.21.10 and 4.5.1; fixed in 3.21.10 and 4.5.1.
- CVE-2026-56301Medium
Nuxt versions 4.0.0 before 4.4.7 and 3.18.0 before 3.21.7, when running the development server (nuxt dev) on Linux, binds the vite-node IPC server to an abstract-namespace Unix socket without permission restrictions, allowing local users to enumerate and connect.
- CVE-2026-56698Medium
Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 fail to validate script-capable URLs in the navigateTo open option, allowing client-side script execution. Attackers can supply javascript: URLs through the open parameter to execute arbitrary scripts in the application's origin.
- CVE-2026-56697Medium
Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 accept protocol-relative paths such as //evil.com in the reloadNuxtApp function. These paths pass the script-protocol check but resolve to a cross-origin URL against the current page protocol.
Original NVD description (English source)
Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, the internal island renderer endpoint `/__nuxt_island/...` decodes and hashes attacker-controlled JSON body input with destr and ohash before validating the URL-resident hash. An unauthenticated `POST /__nuxt_island/_.json` with a large JSON body is fully read, parsed, hashed, and then rejected, which wastes CPU on Nitro single event loop and delays concurrent requests. No valid hash and no authentication are required. This issue is fixed in 3.21.10 and 4.5.1.